CVE-2021-23000: F5 BIG-IP Access Policy Manager

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

On BIG-IP versions 13.1.3.4-13.1.3.6 and 12.1.5.2, if the tmm.http.rfc.enforcement BigDB key is enabled in a BIG-IP system, or the Bad host header value is checked in the AFM HTTP security profile associated with a virtual server, in rare instances, a specific sequence of malicious requests may cause TMM to restart. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected products

  • F5 BIG-IP Access Policy Manager: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Advanced Firewall Manager: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Advanced Web Application Firewall: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Analytics: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Application Acceleration Manager: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Application Security Manager: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Ddos Hybrid Defender: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Domain Name System: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Fraud Protection Service: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Global Traffic Manager: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Link Controller: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Local Traffic Manager: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 BIG-IP Policy Enforcement Manager: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only
  • F5 SSL Orchestrator: from 13.1.3.4, before 13.1.3.6 (fixed in 13.1.3.6); version 12.1.5.2 only

Published 2021-03-31. Last modified 2026-06-17.